Back on 1/17 my request for comments and experiences on either EnCase
Enterprise Edition or ProDiscovery by Technology Pathways was made.
Several professionals have asked me to share those reply's; but hardly any
have been received to date. So here are some specific questions and please
share with us what your doing for live imaging of hard drives. Feel free to
ask questions, express your ideas and concerns. I plan to compile the
responses and make this available to the group.
1. Do you plan to purchase software that will allow you to do live images?.
2. Do you believe this is the technology of the future for our profession in
conducting corporate investigations?
3. Why have you not purchased a solution for live imaging, is the issue
simply the cost?
4. What solutions are you aware of for live imaging?
5. What specific solution are you using to conduct live imaging?
6. Have you had to walk away from any business because you don't have the
technology to do the job of live imaging?
7. How many times have you had to walk away from the business opportunity
because you don't have the technology to do live imaging?
8. Are you planning on purchasing or using a solution in the future to do
live imaging?
9. What can we do as a group to promote use of this technology for live
imaging so that each of us will be in a position to do this type of work?
10. Do you feel that because of the need for corporate investigations using
live imaging that our profession has become one of 'the have and the have
knot's?
11. Have you read the articles on live imaging found in Network Computing
(12/9/04) and The International Journal of Digital Forensics & Incident
response (Dec '04)?
Again, feel free to ask questions, express your ideas and concerns. I plan
to compile the responses and make this available to the group.
Jack Seward
JackSeward@msn.com
New York City
----- Original Message -----
From: "Jack Seward" <JackSeward@msn.com>
To: "Altheide, Cory B. (IARC)" <AltheideC@nv.doe.gov>; "'Jerry Shenk'"
<jshenk@decommunications.com>; <forensics@securityfocus.com>
Sent: Thursday, January 27, 2005 10:45 AM
Subject: Re: Corporate Investigatons
I'm interested in hearing your experiences and comments on the ProDiscover
tool, that is apparently in second right behind EnCase, with its ability
to
image live servers in the enterprise environment.
How fast is imaging with this product, ProDiscover?
Can you convert the image to E01 or dd?
Have you used other tools with the ProDiscover, assumes you can convert
the
image, such as FTK, Paraben, EnCase and what other tools work well with
this
product?
How large were the live servers you imaged with ProDiscover?
What was the learning curve on ProDiscover?
Jack
.
----- Original Message -----
From: "Altheide, Cory B. (IARC)" <AltheideC@nv.doe.gov>
To: "'Jerry Shenk'" <jshenk@decommunications.com>;
<forensics@securityfocus.com>
Sent: Thursday, January 13, 2005 1:41 PM
Subject: RE: Workarounds for Windows Event File corruption
-----Original Message-----
From: Jerry Shenk [mailto:jshenk@decommunications.com]
Sent: Wednesday, January 12, 2005 11:37 AM
To: jeff@jeffbryner.com; forensics@securityfocus.com
Subject: RE: Workarounds for Windows Event File corruption
There is a unix-based suite of tools by Michael Rendell
called "regutils" (http://www/cs.mun.ca/~michael/regutils).
I saw them referenced in a forensic practical by James
Filiberto
(http://www.giac.org/practical/GCFA/James_Filiberto_GCFA.pdf).
Jerry,
How are any of these tools relevant to the discussion at hand (examining
Windows NT/2K/XP EVT files)? The regutils suite consists of (as
described
on the linked page) "win9x registry & ini file manipulation tools for
unix."
Thanks,
Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
altheidec@nv.doe.gov
"I have taken all knowledge to by my province." -- Francis Bacon
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
